PT-2020-4243 · Gnu+6 · Glibc+6
Guido Vranken
·
Published
2020-02-12
·
Updated
2024-06-15
·
CVE-2020-10029
CVSS v3.1
5.5
Medium
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions:
glibc versions prior to 2.32
Description:
The issue is related to the functions cosl, sinl, sincosl, and tanl in the GNU C Library (glibc), which can cause a buffer overflow. This can lead to a denial of service by damaging the stack when calling trigonometric functions with a pseudo-zero argument. Specifically, the problem occurs when an input to an 80-bit long double function contains a non-canonical bit pattern, such as passing a 0x5d414141414141410000 value to sinl on x86 targets.
Recommendations:
For glibc versions prior to 2.32, update to version 2.32 or later to resolve the issue. As a temporary workaround, consider restricting the use of the vulnerable functions cosl, sinl, sincosl, and tanl until a patch is available. Avoid using non-canonical bit patterns as input to these functions to minimize the risk of exploitation.
Exploit
Fix
Buffer Overflow
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Centos
Red Hat
Suse
Ubuntu
Glibc